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A high power density, modular and state-of-the-art Power System Electronics (PSE) has 
been developed for the Lunar Reconnaissance Orbiter (LRO) mission. This paper addresses 
the hardware architecture and performance, the power handling capabilities, and the 
fabrication technology. The PSE was developed by NASA’s Goddard Space Flight Center 
(GSFC) and is the central location for power handling and distribution of the LRO 
spacecraft. The PSE packaging design manages and distributes 2200W of solar array input 
power in a volume less than a cubic foot. The PSE architecture incorporates reliable 
standard internal and external communication buses, solid state circuit breakers and Lilon 
battery charge management. Although a single string design, the PSE achieves high 
reliability by elegantly implementing functional redundancy and internal fault detection and 
correction. The PSE has been environmentally tested and delivered to the LRO spacecraft 
for the flight Integration and Test. This modular design is scheduled to flight in early 2009 
on board the LRO and Lunar Crater Observation and Sensing Satellite (LCROSS) 
spacecrafts and is the baseline architecture for future NASA missions such as Global 
Precipitation Measurement (GPM) and Magnetospheric MultiScale (MMS). 


A 

I 2 C 

i 2 t 

in 

Kg 

V 

W 


I. Introduction 

L RO will start its mission in 2009 orbiting the moon for at least one year. Its objective is to find potential landing 
locations, characterize resources and the environment, and demonstrate new technology. Data from this mission 


Nomenclature 

= amperes 

= i 2 C serial bus communication standard 
= current square versus temperature 
= inches 
= kilogram 
= volts 
= watts 
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will help NASA in the selection of safe locations and environments for future human exploration to the moon and 
beyond 1 . 

The LRO PSE was developed by NASA’s Goddard Space Flight Center (GSFC) and is the central location for 
power handling and distribution of the LRO spacecraft. The PSE packaging design manages and distributes 2200W 
of solar array input power in a volume less than a cubic foot. The PSE architecture incorporates reliable standard 
internal and external communication buses, solid state circuit breakers and Lilon battery charge management. 
Although a single string design, the PSE achieves high reliability by elegantly implementing functional redundancy 
and internal fault detection and correction. The PSE has been environmentally tested and delivered to the LRO 
spacecraft for the flight Integration and Test. This modular design is scheduled to flight in 2009 on board the LRO 
and Lunar Crater Observation and Sensing Satellite (LCROSS) 2 spacecrafts and is the baseline architecture for 
future NASA missions such as Global Precipitation Measurement (GPM) 3 and Magnetospheric MultiScale (MMS) 4 . 


II. PSE Overview 

The PSE of the LRO spacecraft (SC) provides all electrical power to the spacecraft loads for all phases of the 
mission. The basic design and operation of the PSE utilizes the Solar Arrays (SA) to convert sunlight energy into 
electrical energy while in the sunlight or solstice period. The electrical power is then transferred to the PSE where it 
is conditioned and directed to all of the electrical loads connected to the SC bus. During the eclipse seasons, the 
PSE directs sunlight generated electrical power to the battery for recharging. During the eclipse portion of the orbit 
the battery provides all of the energy to the SC. In order to achieve minimum electrical losses due to power 
converters as well as maintaining stable voltage range, the battery is connected directly to the electrical bus. Any 
excess power from the SA not needed for battery charging or SC loads is shunted back to the SA. The PSE 
performs all of the functions related to power distribution as well as battery charging. 
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Figure 1: PSE Architecture 


III. PSE Architecture 

The LRO PSE was developed with several priorities to consider: schedule, cost, reliability, minimum size and 
minimum weight. This unit took advantage of the previous GSFC PSE modular design which permitted this 
design’s quick adjustment of power handling capabilities and still allowing flexibility for design improvements. The 
PSE modular architecture allowed for additional adjustments to the number of cards and load sizing during the 
spacecraft preliminary design phase. The LRO PSE utilizes standard communication busses for internal and 
external interfaces as well as off-the-shelf surface mount components and hybrids to maximize area use. 

The PSE modular architecture is divided by interfaces to simplify its test and spacecraft integration. It consists 
of seven subassemblies each with internal and external interface connections. The main subassembly is the 
backplane to which the other six modules interconnect. Figure 1 presents the PSE interfaces and subassemblies. 
One module or subassembly is dedicated for solar array power interface and power regulation. Another type is 
dedicated for load power distribution. The last module type is dedicated for spacecraft communication, power 
system housekeeping and PSE control. 
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There is a master controller FPGA which has the “soft” control loop for data acquisition, external 
communication, internal fault detection and correction (FDC), and battery coarse charge. The master FPGA 
communicates with a slave FPGA in each of the other cards to collect data, like battery voltage, or to send 
commands, like enabling a load. 

Internal secondary power is generated at one location and distributed through the backplane to each of the cards. 


TV. PSE System 

The PSE supports a direct energy power transfer approach for the spacecraft power systems. It provides 
charging capabilities for a Lilon battery utilizing voltage and current charge control. In this fashion it manages up to 
2200W of solar array power and distributes up to 1500W of load power. The PSE consumes 43 W stand-by power 
and dissipates an additional 39 Watts under the nominal 860W load condition. All this managed in less than a cubic 
foot enclosure. 

The PSE communicates with the spacecraft computer through MIL-STD-1553 protocol on a once per second 
schedule. The internal communication protocol between the cards is the I 2 C serial communication standard. Both 
of these standard protocols provide ease of implementation and test due to readily available test support equipment 
and programming cores. 

The spacecraft loads are serviced from the PSE through the use of latching Solid State Power Controllers (SSPC) 
providing the capability of resettable circuit breaker protection to the users. There are also several services that are 
un-switched (connected directly to the spacecraft bus) for essential loads. 

The PSE has DC/DC converters for internal house-keeping use and main control; however to increase reliability, 
the back up charge control powers itself from the spacecraft bus. In addition, the PSE interfaces with external power 
system signals coming from the solar array and the battery. 

The PSE Modules are: Solar Array Module (SAM), Output Module (OM) and PSE Monitor Card (PMC). The 
following is an explanation of each of these module’s capabilities. 

A. Solar Array Module 

The SAM interfaces with 14 solar array segments at a maximum capacity of 5 A per segment. This board 
provides battery charge control through the use of coarse control of the array segments and fine control of 14% of 
the array to achieve the commanded battery voltage or current. The hardware pulse width modulates 14% of the 
array for efficient fast fine control. The rest of the array is coarse controlled. Every 10ms, the FPGA loop 
determines if additional or less current is needed to maintain the battery charging condition. This card provides a 
backup mode of charge control based on over voltage protection. This mode works independently from the rest of 
the PSE secondary voltage circuitry. 

B. Output Module 

There are a total of four OM subassemblies in the LRO PSE application of this modular design. Through these 
boards the PSE services 48 circuit breaker protected loads and 12 un-switched essential loads. Each switched load is 
protected with the I 2 T curve of a latching Solid State Power Controller. The maximum current through each card is 
40A. The circuit breaker services are either 15 A, 10A, 5 A, 2A, and 1 A. 

C. PSE Monitor Card 

The PMC houses the master controller FPGA on one side of the assembly. This board provides the external 
1553 interface electronics as well as the I 2 C backplane communication. It has a 12bit analog to digital converter 
(ADC) for telemetry acquisition and two 12 bit digital to analog converters (ACD) for commanded references of the 
battery voltage and current charge control. 

The opposite side of this assembly houses the DC/DC converters, a slave FPGA, internal housekeeping telemetry 
and interfaces with external power system signals, such as battery temperature. 

D. Backplane 

The backplane is the power distribution point of the PSE. The battery power, the umbilical power and the SAM 
output are all directly connected to this assembly. It is designed to handle 70A of current flowing through it. This is 
achieved through the use of internal copper layers as well as a copper bus that span the entire length of the 
backplane. This assembly has capacity for six cards and the design of the backplane can be extended to 
accommodate more slots if additional cards are needed. The majority of the power bus capacitance is also located 
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on this backplane. To maximize the copper connection, lower the current path heat and therefore the voltage drop, 
the diode protected umbilical power and the battery power are directly connected to the backplane through external 
connectors. 


V. Battery Charge Control 

The charge control for the PSE is preformed by the Solar Array Module (SAM) in conjunction with the Master 
FPGA on the PMC card. The architecture consists of 14 independent solar array segments feeding the Solar Array 
Module. Each of these strings is identical and normally provides 4.7A. At end of life and hot array, the array peak 
power point is designed to be above 36 volts. The SAM card connected one (un-switched channel) of these strings 
directly to the spacecraft battery bus through a diode. Eleven of the segments (digital channels) are connected to the 
bus through a diode but also incorporate an N-channel MOSFET that allows the shunting of the channel. These 
channels allow for course current control (shunting and un-shunting each channel removes or provides 4.7A of 
current to the spacecraft bus). The final two segments are connected to a switching mode power supply to provide 
fine control of the battery charging. The converter chosen is a standard boost topology. The boost inductor is 
designed to provide approximately 0.36A ripple current during steady state operation. The converter will always be 
in continuous mode operation given that the minimum current from the PWM channels is above 0.2A. 
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Figure 2: SAM/Control loop Block diagram 


The PWM is controlled by two analog control loops. The first controls the battery current and the second 
controls the battery voltage. Each of these control loop references are set by a 12 bit DAC with a range from -100 to 
100 A and 0 to 40V. Nominally the LRO DACs are set at 30A and 33.6V. These DAC values are set to the nominal 
value at power up and can be commanded through the 1553 interface as desired. These two loops are or’ed together 
such that the loop which requires the least amount of battery current is in control. The practical result of this 
control technique causes the battery to charge at a constant current rate once the spacecraft comes out of eclipse until 
the voltage set point is reached. After the voltage set point is reached the PWM will taper the battery charge current 
to maintain the battery voltage at the voltage set point. 

The control loop bandwidth is approximately 200Hz for the current loop. The voltage loop is more prone to 
noise as the ESR of the battery changes with age. As the ESR increases so does the gain of the voltage loop 
therefore the bandwidth of the voltage loop is reduced to 50Hz to allow for a 10X increase in cell ESR. 

The duty cycle of the boost converter is reported from the SAM module to the PMC card directly across the 
backplane. The master controller FPGA digitizes and reads this analog status signal ever 10 milliseconds. If the 
duty cycle is above 90% then one array channel is added to the power bus. If the duty cycle is less than 10% then 
one array channel is taken from the power bus. If the duty cycle is between 10% and 90% the master controller 
FPGA takes no action. 


VI. PSE Internal Digital Control 

The LRO PSE’s digital control block is broken into three parts: Spacecraft Interface, Internal Interface and 
Bypass Interface. The Master Controller (MC) FPGA controls the flow between the spacecraft and the internal 
interfaces. The MC resides on the PMC card assembly within the PSE. The other card assemblies within the PSE 
are addressed digitally through a Slave FPGA. The Bypass interface allows discrete commands to bypass the MC 
and Slave FPGAs in the system to provide further modes of degraded operation. A signal integrity analysis was 
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performed on each digital layout to verily proper routing and termination to the FPGA interfaces. Later on the 
analysis was validated by actual measurements. 

The Internal Interface represents the functions that the MC controls: analog acquisition, DAC control, switch 
control, solar array management, and Slave management. The Internal Interface is controlled via a functional loop 
within the MC. The functional loop runs every second, gathering, checking, and monitoring a variety of data points 
within the PSE. This loop runs independently of the Spacecraft Interface, providing a mechanism to “safe” the 
power system without needing spacecraft/ground intervention. This loop also creates a pre-determined reaction and 
timing to all events with the PSE system, as opposed to an interrupt driven system where events are allowed to 
wander relative to each other. This deterministic reaction/timing allows anomalous events to be debugged, 
recreated, and fixed faster than an interrupt driven system. 

The communication between the Slave and MC FPGAs is accomplished through a modified I 2 C interface. 
(Note: the modification to the I 2 C bus standard was done to increase noise margin versus sample clock frequency on 
each Slave. In all respects, except multi-master, the PSE I 2 C bus agrees with the standard protocol). Each Slave is 
equipped with a primary and secondary I 2 C bus. The MC handles failures of communication to a Slave on a Slave 
per Slave basis, allowing extended degraded modes of operation should a fault only occur within a Slave board 
assembly. The advantages of the I 2 C bus in this system, over a wide data bus (PCI), or simplified UART 
communication are related to the bandwidth necessary for operation and minimal backplane presence. The 
redundant I 2 C bus only requires 4 traces on the backplane. This is much less than a minimal PCI implementation 
and a redundant UART implementation. The UART is a point to point link, and would require space on the 
backplane for each set of signals, for every Slave the MC needs to talk to. The I 2 C bus can also achieve transfer 
rates of 400kbps, which exceeds a UART implementation. A PCI implementation can achieve much faster transfer 
rates, however, in a PSE system, much of the data only exists at the MC (for example, all the analog telemetry) and, 
as such, does not need to be transferred between the Slave and the MC. Combined with a very slow command rate, 
made I 2 C an ideal choice for this system. I 2 C is also easily expandable/contractible, allowing further flexibility 
during the design and unit testing phases. 

The analog acquisition part of the Internal Interface represents the MC control of PMC analog signal 
multiplexers (mux) and control of analog muxes on Slave assemblies. The Slaves share a single backplane analog 
signal for non-critical analog telemetry. Critical analog signals have dedicated lines back to the mux on the PMC 
assembly. By doing this, it allows the system to be grown or shrunk, during the design process, without impacting 
backplane design. To accomplish this architecture, each Slave has 8 bits dedicated to analog mux control. Each 
Slave defines an OFF state for an analog mux that will disconnect the Slaves analog bus from the backplane analog 
bus. The MC is responsible for disconnecting the Slave after an analog sample has been gathered. To further allow 
flexibility during the design/unit testing phases, the analog mux addresses of every analog point is configurable via 
an external EEPROM(ETU)/ROM(FLIGHT) on the PMC assembly. 

The external DACs, on the PMC assembly, are used to set current/voltage references for the solar and battery 
management analog circuitry. This interface amounts to a simple external register write from the MC, which can 
occur during spacecraft commands and/or Fault Detection and Correction (FDC) scenarios. 

Switched services on the Output Module (OM) assemblies within the PSE are controlled via commands sent from 
the spacecraft. The functional loop checks one time during the loop to determine if a switch command exists. 
Should a valid command exist, the MC strips Slave I 2 C address from the command, and sends the rest of the 
command, unaltered, to the appropriate Slave. Keeping the command format between the spacecraft and PMC, and 
the format between the MC and the Slaves similar allows for easier debugging, while still keeping command 
integrity. The MC also manages the number of solar array segments present on the power bus. Every 10ms within 
the functional loop, the MC interrogates the state of the fine charge control loop and determines if solar array 
segments need to be added or removed from the bus. 

The Spacecraft Interface represents the standard 1553 command protocol between the PSE and the Command 
and Data Handling Unit (C&DH). Spacecraft commands were broken into several different “types” and each type 
was assigned its own RT subaddress. This was done to simplify the command formats and to simplify the command 
checks within the MC. At fixed points within the functional loop, the MC goes out to the 1553 interface and checks 
for pending commands in each of the RT subaddresses. Telemetry data was sorted and stored in different RT 
subaddresses based on type and source. 

The Bypass Interface exists on an isolated FPGA. In here, discrete command lines from the various sources 
within the spacecraft are decoded and relayed to the rest of the board assemblies within the PSE. These commands 
allowed for pre-determined spacecraft states to be initiated without the need for the MC or I 2 C interfaces to be 
operational. In addition, once one of these commands is issued, the Slaves block all commanding from the MC. 
This allows the system to become isolated from a problematic error source between the spacecraft and the Slave. As 
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a recovery mechanism, a discrete command was added that would tell the Slaves to return control back to the 
MC/Spacecraft. During a period where a discrete command has been sent, the Slave still allows digital and analog 
TLM to be gathered if capable. This allows further debug should a problem condition be intermittent or difficult to 
debug without impacting the state of the spacecraft. 


VII. Protection 

The PSE is a single string design with “soft” and hardware safing monitor functions for the power system health 
protection. The first level is the master FPGA where there are several Fault Detection and Correction (FDC) checks 
for battery voltage, battery temperature, and SSPC state. These checks are scheduled every second as part of the 
master controller main loop. The PSE can take action if some of these checks are persistently violated. The PSE 
corrective portion of the FDC can be disabled or enabled by the C&DH as the ground system determines necessary 
or according to the phase of the mission (such are the launch phase). The threshold value of these checks can be 
adjusted by command as needed. 

The LRO PSE responds to a second level of protection through hardware commands. These are RS422 
commands received directly from the Command and Data Handling (C&DH) unit. The commands received through 
these channels are verified by a third dedicated FPGA on the PMC. When validated, the respective command pulse 
is forwarded through the backplane to the other assemblies. These dedicated commands are back doors to configure 
the PSE in case of lose of external or internal communication. These can reset the master controller, reconfigure the 
SSPCs to a predetermined state, or prevent array power from shunting. 

The third level of protection is the over voltage protection (OVP). This feature is always active in the 
background of the battery charge cycle and is independent of spacecraft communication or of the PSE internal 
secondary power. Its purpose is to maintain the battery voltage clamped to a predetermined level. This mode 
overwrites the coarse and fine battery charge from the master controller and the pulse width modulator. The OVP is 
coarse in nature as it is hysteresis driven. If control or communication is re-established with the PSE then normal 
operation can be restored to the charger by command. 


VIII. Fabrication 

The technologies and manufacturing processes selected for the LRO PSE 
provided the means for a lighter weight and small overall assembly. The use of 
surface mount and doubled sided boards leads are the core of the PSE fabrication. 

Thermal and structural analyses were performed during the layout of each card to 
prove that the crowded and complicated assemblies were compliant and reliable 
designs. 

A. Enclosure 

The seven subassemblies are integrated in an enclosure with the following 
dimensions: 1 lin wide, 1 1 .5in deep and 9.64in in height. Figure 2 shows a picture of the flight PSE fully assembled. 
The total flight weight of the electronics box is 15.4Kg. 

The card’s locations were assigned in the backplane, and therefore the enclosure, based on power distribution 
current flow and thermal handling. The first card to the left is the SAM followed by four OMs in the middle, and at 
the right side there is the PMC. 

B. Packaging and Fabrication 

Each module assembly is composed of two printed circuit boards (PCB) 
laminated to a metal core, a card-lock, and a stiffener (where needed). This allows 
for two sides of surface area to mount components while maximizing the use of 
copper in the inner layers for high current power planes. This also helps keep the 
plane types clean from each others noise by having separated areas for the power 
section and the signal section without interfere of each other in the PCB z-direction. 

The metal core between the PCBs provides direct mounting area for high power 
dissipation components at the same time that reduces the connection path from the 
heat-sinked part to the board. The packaging and fabrication design is completely 
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Figure 4: Card Packaging. 



Figure 3: PSE Enclosure. 
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surface mount to maximize the surface area available by reducing the number of thru-holes on the three pieces of the 
assembly. 

C. Structural 

A structural analysis was performed for each module and for the housing design. The card frequencies were in 
the range between 260 and 300Hz and the housing was determined and verified 

D. Thermal Management 

The LRO PSE was designed, analyzed and tested for an operational 
temperature range from -10°C to +40°C and a qualification temperature range 
of -20°C to +50°C. The internal components conductive cooling path from the 
modules to the spacecraft mounting plate is from the PCB to the assembly 
metal core, thru the card locks to the box walls. The thermal analysis shown in 
Figure 4 was performed holding the box base plate to +50°C. 

For spacecraft electronic assemblies, reliability depends on maintaining 
temperatures under the de-rating values of its constituent components. This is 
achieved by reducing the thermal resistance between a given component and 
the assembly’s attachment surface to the spacecraft. 

Figure 6 shows a typical thermal path in the LRO PSE assembly from the junction of 
a component to the spacecraft. Each of the path elements are defined by: 


Tl: Represents the junction temperature of a typical electronic component. 

Rl: Is the Theta JC, the component’s junction to case resistance of the device published by the 
manufacturer. 

T2: Case Temperature of the component. 

R2: (Theta CB) is the thermal resistance between the case of the component and the surface to which the 
component is attached, the printed wire board (PWB); typically the resistance of a thermal compound 
(TC) that improves the thermal conductivity to the PWB. 

T3: Is the surface temperature of the PWB in the immediate vicinity of the component. In the case of the 
LRO PSE a typical module is composed of a laminate of a PWB, aluminum heat-sink, PWB laminate. 

R3: Represents the resistance between the component mounting surface of the PWB laminate and the 
aluminum heat-sink. 

T4: Is the temperature of the aluminum heat-sink in the vicinity of the component. 

R4: Is the thermal resistance of the aluminum heat sink (HS) to where it gets attached to the housing. 

T5: Is the temperature on the heat sink side of a typical module. 

R5: Is the thermal resistance of the two sides of the mounting surface of the aluminum heat sink to the 
housing (values given by the wedge-lock/card-guide manufacturer). 

T6: Is the housing temperature at the heat sink. 

R6: Is the housing (or chassis) resistance to the base of the chassis (relatively small). 

T7: Represents the temperature of the base of the housing assembly. 

R7: Is the final resistance representing the interstitial material between the base of the LRO PSE chassis 
and the space craft mounting surface. 

T8: Is the temperature of the space craft’s mounting surface, and is a given value specified in the 
requirements document. 

Figure 6: Typical thermal path diagram 

Given a Q in Watts at the junction J, any reduction in the total resistances between the nodes at Tl through T8 
translates into a reduction in Tl or the junction temperature of a given component. It is worth noting that there are 
components that may not have a junction, such as resistors, with such components the manufacturer’s operating 
temperature is given as the case temperature T2, and the objective of the thermal analyst would be to maintain the 
temperature of the case at the de-rating value. In the case of the LRO PSE, a number of the components had high 
power dissipations (Q), which required the significant reduction of the thermal path from junction (J) to the Space 
Craft (SC). Outlined below are the procedures adopted to implement this reduction. 

To reduce the length of the thermal path, components with high power dissipations were moved close to the base 
plate of the housing. In general this is nearest to the node at T6. In the case of the Solar Array Module (SAM), most 
of the high power dissipaters were moved onto an aluminum extension of the heat-sink called the “Foot” as seen in 
Figure 7. This extension is fastened directly to the chassis with mounting screws through the base of the housing. 
From the thermal diagram above this represents a reduction in R4 and the elimination of R3. The increase in contact 



to be 495Hz. 



Figure 5: Box Thermal Prediction. 
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area reduces R5 by increasing the heat transfer area HTS1 by approximately 
four times that of the other modules using wedge-locks. 

Depending on the copper layers in the epoxy laminate, the out of plane 
thermal resistance of a PWB a fraction of the in plane resistance, and 
although the path from the component to the heat sink is small R 3 could be 
significant, translating into a large delta T (T4-T3) for high power 
dissipating devices. Electrical circuit requirements may render mounting 
components directly on a foot impractical. In the case of the Output Module 
high dissipaters were mounted on a common heat spreader, an aluminum 
plate, which was attached directly to the heat sink. Protrusions in the heat sink through cutouts in the PWB allowed 
the surface of the heat sink to make thermal contact with the heat spreader. An electrically non-conductive, but 
thermally conductive film was used to electrically isolate the spreader from the heat sink. Substituting the resistance 

of the PWB with that of the heat spreader did not eliminate R3, 
however, reduced its thermal resistance sufficiently to bring T1 
under the de-rating value. 

Although the gain is not as large as the above mentioned 
reductions in thermal resistance from J to SC, surface finishes 
play a significant role in reducing thermal contact resistance 
particularly when coupled with increased contact pressure. All 
contacting surfaces were specified to have better than 64 RMS 
(micro-inch) finish. 



Figure 8: Heat sink card extension. 



Figure 7: Heat sink bottom extension. 


IX. Conclusion 

The LRO PSE has been successfully qualified and integrated to the spacecraft. This unit has demonstrated to 
handle 142W/Kg in a volume of 0.02m 1 2 3 4 . Despite the single-string requirement, the PSE accommodates multiple 
spacecraft communication ports (1553 and RS 422), multiple internal I2C internal communications. The spacecraft 
is also provided with a back up battery charge control through the over voltage protection circuitry. 

Given the architecture’s robustness and scalability, the LRO design can be configure to handle much larger 
power systems. Further, the use of a standard spacecraft interface, internal power supplies, standard internal 
communication protocols and telemetry gathering has caused LRO to be the base-line architecture for the current 
NASA GSFC in-house spacecraft development. A testament to this was shown with the rapid reconfiguration and 
production of additional PSE that was used to power the LCROSS spacecraft. 
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